New attack technique: Open Ingress Port 22 on a Firewall Rule (gcp.exfiltration.open-port-22-ingress)

docs/attack-techniques/GCP/gcp.exfiltration.open-port-22-ingress.md

@@ -0,0 +1,63 @@
+---
+title: Open Ingress Port 22 on a Firewall Rule
+---
+
+# Open Ingress Port 22 on a Firewall Rule
+
+
+
+
+Platform: GCP
+
+## Mappings
+
+- MITRE ATT&CK
+    - Exfiltration
+
+
+
+## Description
+
+
+Creates a GCP firewall rule that opens ingress TCP port 22 (SSH) to the world
+(<code>0.0.0.0/0</code>) on a VPC network.
+
+An attacker who has compromised a GCP environment may create such a rule to
+establish SSH access to any VM instance in the affected network, or to exfiltrate
+data by tunnelling traffic over SSH.
+
+<span style="font-variant: small-caps;">Warm-up</span>:
+
+- Create a VPC network
+
+<span style="font-variant: small-caps;">Detonation</span>:
+
+- Create a firewall rule named <code>&lt;vpc&gt;-allow-ssh</code> that allows TCP:22 ingress
+  from <code>0.0.0.0/0</code>
+
+Revert:
+
+- Delete the firewall rule
+
+References:
+
+- https://cloud.google.com/vpc/docs/firewalls
+- https://cloud.google.com/compute/docs/reference/rest/v1/firewalls/insert
+- https://unit42.paloaltonetworks.com/cloud-virtual-machine-attack-vectors/
+- https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudVPC/unrestricted-ssh-access.html
+
+
+## Instructions
+
+```bash title="Detonate with Stratus Red Team"
+stratus detonate gcp.exfiltration.open-port-22-ingress
+```
+## Detection
+
+
+Identify when a firewall rule opening a sensitive port to the world is created by
+monitoring for <code>v1.compute.firewalls.insert</code> events in GCP Admin Activity
+audit logs where <code>sourceRanges</code> includes <code>0.0.0.0/0</code> and
+<code>allowed[].ports</code> contains port 22.
+
+

docs/attack-techniques/GCP/index.md

@@ -82,6 +82,8 @@ Note that some Stratus attack techniques may correspond to more than a single AT
 
 ## Exfiltration
 
+  - [Open Ingress Port 22 on a Firewall Rule](./gcp.exfiltration.open-port-22-ingress.md)
+
   - [Exfiltrate Compute Disk by sharing it](./gcp.exfiltration.share-compute-disk.md)
 
   - [Exfiltrate Compute Image by sharing it](./gcp.exfiltration.share-compute-image.md)

docs/attack-techniques/list.md

@@ -80,6 +80,7 @@ This page contains the list of all Stratus Attack Techniques.
 | [Read GCE Instance Metadata via the Compute API](./GCP/gcp.discovery.download-instance-metadata.md) | [GCP](./GCP/index.md) | Discovery |
 | [Enumerate Permissions of a GCP Service Account](./GCP/gcp.discovery.enumerate-permissions.md) | [GCP](./GCP/index.md) | Discovery |
 | [Modify a GCE Instance Startup Script](./GCP/gcp.execution.modify-gce-startup-script.md) | [GCP](./GCP/index.md) | Execution, Privilege Escalation |
+| [Open Ingress Port 22 on a Firewall Rule](./GCP/gcp.exfiltration.open-port-22-ingress.md) | [GCP](./GCP/index.md) | Exfiltration |
 | [Exfiltrate Compute Disk by sharing it](./GCP/gcp.exfiltration.share-compute-disk.md) | [GCP](./GCP/index.md) | Exfiltration |
 | [Exfiltrate Compute Image by sharing it](./GCP/gcp.exfiltration.share-compute-image.md) | [GCP](./GCP/index.md) | Exfiltration |
 | [Exfiltrate Compute Disk by sharing a snapshot](./GCP/gcp.exfiltration.share-compute-snapshot.md) | [GCP](./GCP/index.md) | Exfiltration |

docs/attack-techniques/mitre-attack-coverage-matrices.md

@@ -55,11 +55,11 @@ This provides coverage matrices of MITRE ATT&CK tactics and techniques currently
 <div class="table-container"><table>
 <thead><tr><th>Initial Access</th><th>Execution</th><th>Persistence</th><th>Privilege Escalation</th><th>Defense Evasion</th><th>Credential Access</th><th>Discovery</th><th>Lateral Movement</th><th>Exfiltration</th><th>Impact</th></tr></thead>
 <tbody>
-<tr><td><a href="../GCP/gcp.initial-access.use-compute-sa-outside-gcp">Steal and Use the GCE Default Service Account Token from Outside Google Cloud</a></td><td><a href="../GCP/gcp.execution.modify-gce-startup-script">Modify a GCE Instance Startup Script</a></td><td><a href="../GCP/gcp.lateral-movement.add-sshkey-instance-metadata">Register SSH public key to instance metadata</a></td><td><a href="../GCP/gcp.execution.modify-gce-startup-script">Modify a GCE Instance Startup Script</a></td><td><a href="../GCP/gcp.defense-evasion.delete-dns-logs">Delete a Cloud DNS Logging Policy</a></td><td><a href="../GCP/gcp.credential-access.secretmanager-retrieve-secrets">Retrieve a High Number of Secret Manager secrets</a></td><td><a href="../GCP/gcp.discovery.download-instance-metadata">Read GCE Instance Metadata via the Compute API</a></td><td><a href="../GCP/gcp.lateral-movement.add-sshkey-instance-metadata">Register SSH public key to instance metadata</a></td><td><a href="../GCP/gcp.exfiltration.share-compute-disk">Exfiltrate Compute Disk by sharing it</a></td><td><a href="../GCP/gcp.impact.create-gpu-vm">Create a GCE GPU Virtual Machine</a></td></tr>
-<tr><td></td><td><a href="../GCP/gcp.execution.modify-vertex-notebook-startup">Inject a Malicious Startup Script into a Vertex AI Workbench Instance</a></td><td><a href="../GCP/gcp.persistence.backdoor-service-account-policy">Backdoor a GCP Service Account through its IAM Policy</a></td><td><a href="../GCP/gcp.persistence.create-admin-service-account">Create an Admin GCP Service Account</a></td><td><a href="../GCP/gcp.defense-evasion.disable-audit-logs">Disable Data Access Audit Logs for a GCP Service</a></td><td><a href="../GCP/gcp.initial-access.use-compute-sa-outside-gcp">Steal and Use the GCE Default Service Account Token from Outside Google Cloud</a></td><td><a href="../GCP/gcp.discovery.enumerate-permissions">Enumerate Permissions of a GCP Service Account</a></td><td></td><td><a href="../GCP/gcp.exfiltration.share-compute-image">Exfiltrate Compute Image by sharing it</a></td><td><a href="../GCP/gcp.impact.create-instances-in-multiple-zones">Create GCE Instances in Multiple Zones</a></td></tr>
-<tr><td></td><td><a href="../GCP/gcp.execution.os-config-run-command">Execute Commands on GCE Instances via OS Config Agent</a></td><td><a href="../GCP/gcp.persistence.create-admin-service-account">Create an Admin GCP Service Account</a></td><td><a href="../GCP/gcp.persistence.create-service-account-key">Create a GCP Service Account Key</a></td><td><a href="../GCP/gcp.defense-evasion.remove-project-from-organization">Attempt to Remove a GCP Project from its Organization</a></td><td></td><td></td><td></td><td><a href="../GCP/gcp.exfiltration.share-compute-snapshot">Exfiltrate Compute Disk by sharing a snapshot</a></td><td></td></tr>
-<tr><td></td><td></td><td><a href="../GCP/gcp.persistence.create-service-account-key">Create a GCP Service Account Key</a></td><td><a href="../GCP/gcp.privilege-escalation.impersonate-service-accounts">Impersonate GCP Service Accounts</a></td><td><a href="../GCP/gcp.defense-evasion.remove-vpc-flow-logs">Disable VPC Flow Logs on a Subnet</a></td><td></td><td></td><td></td><td><a href="../GCP/gcp.exfiltration.backdoor-gcs-bucket">Backdoor a GCS Bucket via Overly Permissive IAM Policy</a></td><td></td></tr>
-<tr><td></td><td></td><td><a href="../GCP/gcp.persistence.invite-external-user">Invite an External User to a GCP Project</a></td><td><a href="../GCP/gcp.execution.modify-vertex-notebook-startup">Inject a Malicious Startup Script into a Vertex AI Workbench Instance</a></td><td><a href="../GCP/gcp.defense-evasion.delete-logging-sink">Delete a GCP Log Sink</a></td><td></td><td></td><td></td><td></td><td></td></tr>
+<tr><td><a href="../GCP/gcp.initial-access.use-compute-sa-outside-gcp">Steal and Use the GCE Default Service Account Token from Outside Google Cloud</a></td><td><a href="../GCP/gcp.execution.modify-gce-startup-script">Modify a GCE Instance Startup Script</a></td><td><a href="../GCP/gcp.lateral-movement.add-sshkey-instance-metadata">Register SSH public key to instance metadata</a></td><td><a href="../GCP/gcp.execution.modify-gce-startup-script">Modify a GCE Instance Startup Script</a></td><td><a href="../GCP/gcp.defense-evasion.delete-dns-logs">Delete a Cloud DNS Logging Policy</a></td><td><a href="../GCP/gcp.credential-access.secretmanager-retrieve-secrets">Retrieve a High Number of Secret Manager secrets</a></td><td><a href="../GCP/gcp.discovery.download-instance-metadata">Read GCE Instance Metadata via the Compute API</a></td><td><a href="../GCP/gcp.lateral-movement.add-sshkey-instance-metadata">Register SSH public key to instance metadata</a></td><td><a href="../GCP/gcp.exfiltration.open-port-22-ingress">Open Ingress Port 22 on a Firewall Rule</a></td><td><a href="../GCP/gcp.impact.create-gpu-vm">Create a GCE GPU Virtual Machine</a></td></tr>
+<tr><td></td><td><a href="../GCP/gcp.execution.modify-vertex-notebook-startup">Inject a Malicious Startup Script into a Vertex AI Workbench Instance</a></td><td><a href="../GCP/gcp.persistence.backdoor-service-account-policy">Backdoor a GCP Service Account through its IAM Policy</a></td><td><a href="../GCP/gcp.persistence.create-admin-service-account">Create an Admin GCP Service Account</a></td><td><a href="../GCP/gcp.defense-evasion.disable-audit-logs">Disable Data Access Audit Logs for a GCP Service</a></td><td><a href="../GCP/gcp.initial-access.use-compute-sa-outside-gcp">Steal and Use the GCE Default Service Account Token from Outside Google Cloud</a></td><td><a href="../GCP/gcp.discovery.enumerate-permissions">Enumerate Permissions of a GCP Service Account</a></td><td></td><td><a href="../GCP/gcp.exfiltration.share-compute-disk">Exfiltrate Compute Disk by sharing it</a></td><td><a href="../GCP/gcp.impact.create-instances-in-multiple-zones">Create GCE Instances in Multiple Zones</a></td></tr>
+<tr><td></td><td><a href="../GCP/gcp.execution.os-config-run-command">Execute Commands on GCE Instances via OS Config Agent</a></td><td><a href="../GCP/gcp.persistence.create-admin-service-account">Create an Admin GCP Service Account</a></td><td><a href="../GCP/gcp.persistence.create-service-account-key">Create a GCP Service Account Key</a></td><td><a href="../GCP/gcp.defense-evasion.remove-project-from-organization">Attempt to Remove a GCP Project from its Organization</a></td><td></td><td></td><td></td><td><a href="../GCP/gcp.exfiltration.share-compute-image">Exfiltrate Compute Image by sharing it</a></td><td></td></tr>
+<tr><td></td><td></td><td><a href="../GCP/gcp.persistence.create-service-account-key">Create a GCP Service Account Key</a></td><td><a href="../GCP/gcp.privilege-escalation.impersonate-service-accounts">Impersonate GCP Service Accounts</a></td><td><a href="../GCP/gcp.defense-evasion.remove-vpc-flow-logs">Disable VPC Flow Logs on a Subnet</a></td><td></td><td></td><td></td><td><a href="../GCP/gcp.exfiltration.share-compute-snapshot">Exfiltrate Compute Disk by sharing a snapshot</a></td><td></td></tr>
+<tr><td></td><td></td><td><a href="../GCP/gcp.persistence.invite-external-user">Invite an External User to a GCP Project</a></td><td><a href="../GCP/gcp.execution.modify-vertex-notebook-startup">Inject a Malicious Startup Script into a Vertex AI Workbench Instance</a></td><td><a href="../GCP/gcp.defense-evasion.delete-logging-sink">Delete a GCP Log Sink</a></td><td></td><td></td><td></td><td><a href="../GCP/gcp.exfiltration.backdoor-gcs-bucket">Backdoor a GCS Bucket via Overly Permissive IAM Policy</a></td><td></td></tr>
 <tr><td></td><td></td><td></td><td></td><td><a href="../GCP/gcp.defense-evasion.disable-logging-sink">Disable a GCP Log Sink</a></td><td></td><td></td><td></td><td></td><td></td></tr>
 <tr><td></td><td></td><td></td><td></td><td><a href="../GCP/gcp.defense-evasion.reduce-sink-log-retention">Reduce Log Retention Period on a Cloud Logging Sink Bucket</a></td><td></td><td></td><td></td><td></td><td></td></tr>
 </tbody>

docs/index.yaml

@@ -642,6 +642,13 @@ GCP:
           platform: GCP
           isIdempotent: false
     Exfiltration:
+        - id: gcp.exfiltration.open-port-22-ingress
+          name: Open Ingress Port 22 on a Firewall Rule
+          isSlow: false
+          mitreAttackTactics:
+            - Exfiltration
+          platform: GCP
+          isIdempotent: false
         - id: gcp.exfiltration.share-compute-disk
           name: Exfiltrate Compute Disk by sharing it
           isSlow: false

v2/internal/attacktechniques/gcp/exfiltration/open-port-22-ingress/main.go

@@ -0,0 +1,138 @@
+package gcp
+
+import (
+	"context"
+	_ "embed"
+	"fmt"
+	"log"
+
+	compute "cloud.google.com/go/compute/apiv1"
+	"cloud.google.com/go/compute/apiv1/computepb"
+	"github.com/datadog/stratus-red-team/v2/pkg/stratus"
+	"github.com/datadog/stratus-red-team/v2/pkg/stratus/mitreattack"
+)
+
+//go:embed main.tf
+var tf []byte
+
+func init() {
+	stratus.GetRegistry().RegisterAttackTechnique(&stratus.AttackTechnique{
+		ID:           "gcp.exfiltration.open-port-22-ingress",
+		FriendlyName: "Open Ingress Port 22 on a Firewall Rule",
+		Description: `
+Creates a GCP firewall rule that opens ingress TCP port 22 (SSH) to the world
+(<code>0.0.0.0/0</code>) on a VPC network.
+
+An attacker who has compromised a GCP environment may create such a rule to
+establish SSH access to any VM instance in the affected network, or to exfiltrate
+data by tunnelling traffic over SSH.
+
+Warm-up:
+
+- Create a VPC network
+
+Detonation:
+
+- Create a firewall rule named <code>&lt;vpc&gt;-allow-ssh</code> that allows TCP:22 ingress
+  from <code>0.0.0.0/0</code>
+
+Revert:
+
+- Delete the firewall rule
+
+References:
+
+- https://cloud.google.com/vpc/docs/firewalls
+- https://cloud.google.com/compute/docs/reference/rest/v1/firewalls/insert
+- https://unit42.paloaltonetworks.com/cloud-virtual-machine-attack-vectors/
+- https://www.trendmicro.com/cloudoneconformity/knowledge-base/gcp/CloudVPC/unrestricted-ssh-access.html
+`,
+		Detection: `
+Identify when a firewall rule opening a sensitive port to the world is created by
+monitoring for <code>v1.compute.firewalls.insert</code> events in GCP Admin Activity
+audit logs where <code>sourceRanges</code> includes <code>0.0.0.0/0</code> and
+<code>allowed[].ports</code> contains port 22.
+`,
+		Platform:                   stratus.GCP,
+		IsIdempotent:               false,
+		MitreAttackTactics:         []mitreattack.Tactic{mitreattack.Exfiltration},
+		PrerequisitesTerraformCode: tf,
+		Detonate:                   detonate,
+		Revert:                     revert,
+	})
+}
+
+func detonate(params map[string]string, providers stratus.CloudProviders) error {
+	gcp := providers.GCP()
+	projectId := gcp.GetProjectId()
+	vpcName := params["vpc_name"]
+	ctx := context.Background()
+
+	client, err := compute.NewFirewallsRESTClient(ctx, gcp.Options())
+	if err != nil {
+		return fmt.Errorf("failed to create firewalls client: %w", err)
+	}
+	defer client.Close()
+
+	firewallName := vpcName + "-allow-ssh"
+	log.Printf("Creating firewall rule %s allowing TCP:22 from 0.0.0.0/0 on VPC %s\n", firewallName, vpcName)
+	op, err := client.Insert(ctx, &computepb.InsertFirewallRequest{
+		Project: projectId,
+		FirewallResource: &computepb.Firewall{
+			Name:      ptr(firewallName),
+			Network:   ptr(fmt.Sprintf("projects/%s/global/networks/%s", projectId, vpcName)),
+			Direction: ptr("INGRESS"),
+			Allowed: []*computepb.Allowed{
+				{
+					IPProtocol: ptr("tcp"),
+					Ports:      []string{"22"},
+				},
+			},
+			SourceRanges: []string{"0.0.0.0/0"},
+		},
+	})
+	if err != nil {
+		return fmt.Errorf("failed to create firewall rule: %w", err)
+	}
+
+	if err = op.Wait(ctx); err != nil {
+		return fmt.Errorf("failed waiting for firewall rule creation: %w", err)
+	}
+
+	log.Printf("Successfully created firewall rule %s\n", firewallName)
+	return nil
+}
+
+func revert(params map[string]string, providers stratus.CloudProviders) error {
+	gcp := providers.GCP()
+	projectId := gcp.GetProjectId()
+	vpcName := params["vpc_name"]
+	ctx := context.Background()
+
+	client, err := compute.NewFirewallsRESTClient(ctx, gcp.Options())
+	if err != nil {
+		return fmt.Errorf("failed to create firewalls client: %w", err)
+	}
+	defer client.Close()
+
+	firewallName := vpcName + "-allow-ssh"
+	log.Printf("Deleting firewall rule %s\n", firewallName)
+	op, err := client.Delete(ctx, &computepb.DeleteFirewallRequest{
+		Project:  projectId,
+		Firewall: firewallName,
+	})
+	if err != nil {
+		return fmt.Errorf("failed to delete firewall rule: %w", err)
+	}
+
+	if err = op.Wait(ctx); err != nil {
+		return fmt.Errorf("failed waiting for firewall rule deletion: %w", err)
+	}
+
+	log.Printf("Successfully deleted firewall rule %s\n", firewallName)
+	return nil
+}
+
+func ptr[T any](v T) *T {
+	return &v
+}

v2/internal/attacktechniques/gcp/exfiltration/open-port-22-ingress/main.tf

@@ -0,0 +1,35 @@
+terraform {
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 6.18.1"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "~> 3.3.2"
+    }
+  }
+}
+
+locals {
+  resource_prefix = "stratus-red-team-opi22" # open port ingress 22
+}
+
+resource "random_string" "suffix" {
+  length    = 8
+  special   = false
+  min_lower = 8
+}
+
+resource "google_compute_network" "vpc" {
+  name                    = "${local.resource_prefix}-vpc-${random_string.suffix.result}"
+  auto_create_subnetworks = false
+}
+
+output "vpc_name" {
+  value = google_compute_network.vpc.name
+}
+
+output "display" {
+  value = format("VPC network %s", google_compute_network.vpc.name)
+}

v2/internal/attacktechniques/main.go

@@ -78,6 +78,7 @@ import (
 	_ "github.com/datadog/stratus-red-team/v2/internal/attacktechniques/gcp/execution/modify-vertex-notebook-startup"
 	_ "github.com/datadog/stratus-red-team/v2/internal/attacktechniques/gcp/execution/os-config-run-command"
 	_ "github.com/datadog/stratus-red-team/v2/internal/attacktechniques/gcp/exfiltration/backdoor-gcs-bucket"
+	_ "github.com/datadog/stratus-red-team/v2/internal/attacktechniques/gcp/exfiltration/open-port-22-ingress"
 	_ "github.com/datadog/stratus-red-team/v2/internal/attacktechniques/gcp/exfiltration/share-compute-disk"
 	_ "github.com/datadog/stratus-red-team/v2/internal/attacktechniques/gcp/exfiltration/share-compute-image"
 	_ "github.com/datadog/stratus-red-team/v2/internal/attacktechniques/gcp/exfiltration/share-compute-snapshot"